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1. INTRODUCTION 

There was widespread fear that the Severe Acute Respiratory Syndrome (SARS) virus had publishing 
around the world by the end of 2003, owing to its alarmingly high infection rates in Asia and outbreaks in the 
Middle East, as well as in nations such as Russia that had never seen it previously [1], [2]. This prompted 
individuals to raise awareness of viruses, which have developed into important hazards in the twenty-first 
century. The World Health Organization (WHO) designated 2019-nCov (COVID-19) as the coronavirus of the 
year [3]. Several of the researches devoted to various problems connected to COVID-19 and solved by area of 
computer science for example expecting COVID-19 symptoms with several kinds of pneumonia utilizing X- 
rays scans [4], examining the function of new technologies in fighting the COVID-19 pandemic [5], 
discovering the effects of coronavirus on power industry [6] and more. The majority of papers focus on 
categorization and classification COVID-19 CT and X-ray images [7]-[10]. The purpose of this research is to 
detect and classify different types of forgery in the COVID-19 dataset while the medical images were being 
transmitted from one location to another. 

Data transmission through the Internet has become important for numerous fields to share data such 
as medicine, education, and digital forensics. Medical images can be transmitted and delivered through the 
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Internet to allow the diagnosis among medical staff and access to the history of the patient from any place. 
There is various software used for changing the content of an image to create a forged one. This type of change 
is called image forgery. Forged images display that the alteration in the image cannot be noticed by a visual 
check. Therefore, checking the authentication of medical image content has become vital because any alteration 
in the medical images can cause a wrong diagnosis. 

There are two approaches employed in image forgery detection: active and passive approaches 
[11], [12]. The active technique is categorized into two approaches: digital signature and watermarking. In 
these techniques, a watermark and the signature are embedded into images during the pre-processing stage. 
The most public types of passive approaches are image splicing and copy-move (CM). In CM technique, a 
fragment of the image is copied and embedded into another area in the same image [13], [14]. The splicing 
technique used fragments of different images and pastes them into another image [15], [16]. The existing 
algorithms achieve acceptable performance in detecting passive image forgery. However, they cannot achieve 
high detection accuracy with a small forgery region. 

The proposed model's primary goal is to notice the splicing and copy-move manipulation in 
COVID-19, viral pneumonia, and normal images. Deep transfer learning (DTL) presents an outstanding 
performance in different computer vision problems included image classification [17], and semantic 
segmentation [18]. Deep learning is a type of multi-layer neural network, in which every layer makes the output 
from the preceding convolution layer available to the next layer as an input. It can extract complex features 
from medical images automatically. Deep transfer learning (DTL) can be used on images used in medicine to 
detect a CM and splicing forgery that the naked eye cannot see. Alexnet [19], Googlenet [20], and Resnet [21] 
use learned features from training images and then classify the image. The rest of the paper is ordered. Section 
2 presents the related work of forgery image detection. The proposed algorithm introduces in section 3. Section 
4 contains the experimental results. The conclusions show in the final section. 


2. RELATED WORKS 

Various algorithms are proposed in this section to deal with image forgery. First, we will discuss the 
numerous splicing techniques and then copy-move techniques. In [22], a method for noticing splicing forgery 
depending on Haar wavelet transform (HWT) and uniform local binary pattern (ULBP) is presented. First, the 
RGB image is transformed into the YCbCr model and then HWT is applied to produce the four sub-bands. For 
every band, ULBP is computed. The final vector is concatenated from all sub-bands. For classification, support 
vector machine (SVM) is used. 

An algorithm in [23] is focused on convolutional neural network (CNN) and HWT is suggested to 
identify the spliced images. HWT is applied after CNN is used to extract features. Finally, SVM is used to 
classify images. An algorithm for detecting the alternating in the image is suggested in [24]. It is focused on 
using LBP and discrete cosine transform (DCT). For each block in the chrominance component, LBP and DCT 
are applied. For detection, SVM is used. 

Ulutas et al. [25] presented a passive image algorithm to recognize the forged areas on medical 
images. LBP rotation invariant and scale-invariant feature transform (SIFT) are applied to extract the key points 
from the medical images. By matching the key points, forged regions are detected. In [26], CNN and error 
level analysis (ELA) are used to discover forgery in COVID-19 medical images by detecting the noise pattern. 
The algorithm achieves an accuracy of 92% for detecting image is forged or not. 

The algorithm in [27] is used Markov features for extracting features from two domains: DWT and 
LBP. Then, features are combined from both domains and fed to SVM for classification. Six benchmark 
datasets are used to evaluate the algorithm. In [28], an algorithm is based on feature matching and CNN to 
detect CM forgery. In CNN, many convolution and pooling layers are utilized for feature extraction and then 
apply characterization among original and tampered images. To identify a CM forgery in [29], DWT and DCT 
are used for feature extraction. Apply DWT to the image first, and then divide it into blocks. DCT is used for 
all block, and the correlation coefficients are compared. 


3. THE PROPOSED MODEL ARCHITECTURE 

In this paper, a DLT approach is employed to identify the features of tampered regions. Splice and 
copy-move are image forgery techniques that are difficult to tell apart from genuine ones. Many algorithms are 
developed to detect image forgery. The existing algorithms suffer from low accuracy. Deep learning offers a 
solution for digital image authentication because it extracts complex features from an image. The model relies 
on three DTL models Alexnet, Googlenet, and Resnet50 to make features extraction and classification 
processes at the same time as illustrated in Figure 1. These models need the least training time than other 
pre-trained DLT models. Algorithm 1 shows the steps of the proposed model. The architecture of Alexnet is 
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consisting of eight layers, the first five layers are convolutional, and the remaining layers are fully connected. 
After the first two convolutional layers, there is a max-pooling layer in size 3x3. The remainder of the 
convolution layers is connected to fully connected layers. After every convolution layer, an activation function 
is utilized called rectified linear unit (ReLU) nonlinearity. Different filters are used in each convolution layer. 
For example, 96 kernels of size 11 x 11 X 3 are used in the first layer. 


‘i 


COVID-19 Resnet50 | Alexnet Googlenet 
Dataset 


2 classes 
3 classes 
6 classes 
9 classes 


Model 
Performance 
Evaluation 


2 classes ( Forgery- No Forgery) 

3 classes ( Copy Move Forgery — Splicing Forgery — No Forgery) 

6 classes (COVID-19 Forgery — Pneumonia Forgery— Normal Forgery - COVID-19 — Pneumonia — Normal) 

9 classes (CM COVID-19 Forgery - CM Pneumonia Forgery- CM Normal Forgery - S COVID-19 Forgery — S Pneumonia Forgery- S Normal Forgery - COVID-19 — Pneumonia — Normal) 


Figure 1. Proposed model architecture 


ResNet stands for residual network, and it has many versions, Rsenet50O is one of these versions. 
Resnet50 has used 50 neural network layers with 48 convolution layers and two pooling layers. It consists of 
five stages every stage with a convolution layer and Individuality block. Each block contains three convolution 
layers, and every Individuality block has three convolution layers. 

There are three versions of Inception Networks, which are called inception versions 1, 2, and 3. The 
GoogleNet or Inception V1 consists of 22 layers deep, 27 pooling layers, and 9 inception Layers and it is 
proposed in 2014. The inception layer is a collection of all 1x1 convolutional layers, 3x3 convolutional layer, 
and 5x5 convolutional layer to reduce the size of parameters in the network. The output of inception 
is merged and sent to the next layer. At the end of the network, global average pooling is used to reduce the 
number of trainable parameters. 


Algorithm 1: The Suggested Model Algorithm 

Input: COVID-19 Database and the Tampered Dataset 

Output: Classification of the copy-move and splicing forgery of three classes {COVID- 
19, Viral Pneumonia, Normal} 


1s Copy Move (CM) forgery is created by copying and pasting a portion of an image from each 
class. 

2. A portion of each class is copied and pasted into the various images to produce splicing 
forgery. 


3 Download DTL models: Alexnet, Resnet50, and Googlenet 

4. Train the proposed model with two, three, six, and nine classes 

Os For every image in the dataset 

6 Scale the input image to its default DTL aspects. 

7 Provide the images to the DTL model for extraction and classification of features. 
8 End 


4. DATASET CHARACTERISTICS 

The COVID-19 Radiography database utilized for training and testing is taken from the open-source 
platform [30]. The dataset included three classes: 3,616 COVID-19, 10,129 normal and 1,345 viral pneumonia 
images. The following operations are applied to the COVID-19, normal, and viral pneumonia images to create 
the tampered images. 

In the first operation, a region from each class of the original image is copied and pasted into the same 
image to make a copy-move forgery. An area from the medical images is copied and pasted into other regions 
in the different images to generate splicing forgery images. The dataset is available online on Mendeley data 
[31]. the dataset consists of {COVID-19 2,000 images, CM COVID-19 2,000 images, S COVID-19 2,000 
images, Viral Pneumonia 1,340 images, CM Viral Pneumonia 1,340 images, S Viral Pneumonia 850 images, 
Normal 2,000 images, CM Normal 2,000 images, S Normal 2,000 images }. Figure 2 shows the original images 
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as shown in Figure 2(a), the result of copy-move as shown in Figure 2(b), and splicing forgery as shown in 
Figure 2(c) of the COVID-19 image, viral Pneumonia, and normal respectively. 


Viral Pneumonia | ze 
(@) (b) (©) 


Figure 2. Sample images from the Radiography database, (a) original images, (b) Copy-move, and 
(c) Splicing forgery techniques 


5. EXPERIMENTAL RESULTS 

This section presents the results of the conducted experiments and the metrics used to evaluate the 
performance of the proposed model. For each experiment, a computer with 32 GB of RAM and an Intel Xeon 
processor was utilized. The system contains an NVIDIA TITAN XP Graphics Card. The development of 
experiments was GPU-specific to the software package MATLAB R2021b. The following hyperparameters 
were applied to all experimental outcomes during the training and testing phases: 
— Model DTL: Alexnet-Googlenet-Resnet50 
— Training: 80%, Testing: 20%. 
— Optimizer: Adamboost 
— Momentum: 0.9 
— Learning Rate: 0.001 
—  Epochs: 40 
— Batch size: 32 
— Early stopping: 5 epochs 


5.1. Evaluation metrics 

The experimental results of the algorithm are measured using different metrics such as accuracy, 
precision, F-Measure, and recall. When dealing with data that is not balanced, precision and recall are better 
suited for identifying a model's errors. The predictive performance of a model is summarized by the F-score, 
which is the harmonic mean of precision and recall. The definitions are presented from (1) to (4), 


. TPos+TNeg 
Testing Accuracy = 22. 1 
8 y (TPos+FPos)+( TNeg+FNeg) ( ) 
Cray TPos 
Precision = —————_ (2) 
(TPos+FPos) 
TruePos 
Recall = — = °s — (3) 
(TPos+FNeg) 


Precision*Recall 
F1 Score = 2 * ——————_ (4) 


(Precision+Recall) 
where TPos is the total number of true positive samples, TNeg is the total number of true negative samples, 


FalsePos is the total number of false positive samples, and FalseNeg is the total number of false negative 
samples from a confusion matrix. 
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5.2. Results and discussion 

Four classification experiments were conducted to evaluate the performance of the proposed model. 
The first classification experiment includes two classes (Forgery or no forgery). Table 1 shows the 
classification results obtained from Alexnet, Google net, and Resnet50. As shown in Table 1, Resnet50 


achieves the highest accuracy possible in the recall, precision, F-score, and testing accuracy if it is compared 
to the other DTL models. 


Table 1. Testing accuracy and performance metrics for the first classification experiment (Forgery or 
no forgery) using different DTL models 


Recall Precision FScore Testing Accuracy 


Alexnet 0.8955 — 0.9232 0.9091 0.9109 
Googlenet 0.9222 0.9463 0.9341 0.9363 
Resnet50 (0.9347 0.9544 0.9445 0.9472 


The second classification experiment was dedicated to three classes, and they are (Copy-move 
forgery, splicing forgery, or no forgery). The testing accuracies are 80.66% in Resnet50, 77.73% in Googlenet, 
and 66.96 % in Alexnet as shown in Table 2. The results proved the effectiveness of Resnet50O in detecting 
forged images same as in the first classification experiment. 


Table 2. Testing accuracy and performance metrics for the second classification experiment for 3 classes 
(CM forgery, S forgery or no forgery) using different DTL models 


Recall Precision FScore Testing Accuracy 


Alexnet 0.6888 0.6616 0.6749 0.6696 
Googlenet 0.7882 0.7732 0.7807 0.7773 
Resnet50 —_(0.8123 0.8045 0.8084 0.8066 


To test the ability of the proposed model, different forgeries techniques for the different main classes 
are proposed. The Third classification experiment was conducted on six classes, and they are {CM forgery in 
COVID-19, splicing in COVID-19, CM forgery in Viral Pneumonia, splicing in Viral Pneumonia, CM forgery 
in Normal, splicing in Normal} as presented in Table 3. The classification testing accuracy was 79.6% using 
Resnet50 which is the highest testing accuracy possible. 


Table 3. Testing accuracy and performance metrics for the third classification experiment for 6 classes using 


different DTL models 
Recall Precision F Score Testing Accuracy 
Alexnet 0.7179 0.712 0.715 0.7072 
Googlenet 0.7668 — 0.7598 0.7633 0.7607 
Resnet50__0.7913___—(0.7864 0.7888 0.7960 


The Fourth classification experiment was dedicated to classifying different nine classes, and they are 
CM forgery in COVID-19, Splicing in COVID-19, COVID-19, CM forgery in Viral Pneumonia, splicing in 
Viral Pneumonia, Viral Pneumonia, CM forgery in Normal, Splicing in Normal, Normal). In Table 4, the 
testing accuracies were 83.82% in Resnet50, 77.16% in Googlenet, and 68.15 % in Alexnet. The results proved 


the effectiveness of Resnet50 in detecting forged images same as in the first, second, and third classification 
experiments. 


Table 4. Testing accuracy and performance metrics for the fourth classification experiment for 9 classes 
using different DTL models 


Recall Precision FScore Testing Accuracy 


Alexnet 0.6844 ~— 0.7003 0.6923 0.6815 
Googlenet 0.7715 0.798 0.7846 0.7716 
Resnet5O0 (0.8304 0.8382 0.8343 0.8382 
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6. CONCLUSION 

Image splicing and copy-move forgery are well-known techniques in the forgery domain. The spliced 
image was carried out by copying and pasting some portions from one image into other images. In this paper, 
a proposed model for identifying two techniques in image forgery is proposed. To achieve good results, the 
proposed algorithm used three DLTs that extract features from images. The selected dataset consisted of three 
classes (COVID-19, Viral pneumonia, and Normal) class and we made two operations in images to generate 
CM and splicing forgery. We used the difference between the normal, viral, and COVID-19 images to train the 
model. The proposed model can efficiently identify image splicing and copy-move forgery of images. The 
proposed algorithm achieved a relatively high detection accuracy of 94.72% of Resnet50 for the classification 
of two classes. The model accomplished 80.66% in testing accuracy for three classes (Copy-move forgery, 
splicing forgery, and no forgery). Moreover, the model achieves 79.60% and 83.82% for the 6 and 9 classes 
classification respectively. Performance indicators such as recall, precision, and Fl Score supported the 
obtained results and proved that the proposed model was efficient for detecting manipulation in digital medical 
images. 
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